[wasm] Break a decoder loop if there is a failure.

TEST=unittests/WasmModuleVerifyTest.Regression_648070
BUG=chromium:648070
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2356253002
Cr-Commit-Position: refs/heads/master@{#39602}

src/wasm/module-decoder.cc

@@ -164,6 +164,7 @@ class ModuleDecoder : public Decoder {
           uint32_t functions_count = consume_u32v("functions count");
           module->functions.reserve(SafeReserve(functions_count));
           for (uint32_t i = 0; i < functions_count; ++i) {
+            if (failed()) break;
             module->functions.push_back({nullptr,  // sig
                                          i,        // func_index
                                          0,        // sig_index

test/unittests/wasm/module-decoder-unittest.cc

@@ -1160,6 +1160,15 @@ TEST_F(WasmModuleVerifyTest, FunctionSignatures_one) {
   EXPECT_VERIFIES(data);
 }
 
+TEST_F(WasmModuleVerifyTest, Regression_648070) {
+  static const byte data[] = {
+      SECTION(SIGNATURES, 1), 0,        // --
+      SECTION(FUNCTION_SIGNATURES, 5),  // --
+      U32V_5(3500228624)                // function count = 3500228624
+  };                                    // --
+  EXPECT_FAILURE(data);
+}
+
 TEST_F(WasmModuleVerifyTest, FunctionBodies_empty) {
   static const byte data[] = {
       EMPTY_SIGNATURES_SECTION,           // --